Businesses already burdened with the impact of the pandemic have yet another growing worry – ransomware. According to Beazley, a syndicate of Lloyds of London, the threat of ransomware has increased exponentially. Beazley’s latest statistics reflect a 239% increase in claims in their US middle market arena. Furthermore, ransomware payments were three times larger than for the prior reporting period.
Equally disconcerting has been the change in focus from monetary payoff alone to the acquisition of information. In addition to an extortion demand, hackers are often threatening to sell or publish data and identify victims if the ransom demand is not met. Be aware that your risk is not isolated to intrusion into your own system. According to CrowdStrike, “An alarming trend in targeted ransomware operations is the compromise of managed service providers.”
The ultimate cost to your business of addressing a ransomware demand is not limited to the ransom. This payment is often a mere drop in the bucket. Just a few of the additional costs include:
- Reputational risk – Damage to the business name and brand in the marketplace and subsequent loss of business;
- Forensic expenses – Tracing the source of the breach, determining whether it is more expansive than initially thought, and assuring management that the problem has been resolved;
- Lost time – IT professionals and senior management will undoubtedly devote countless hours to this serious issue, diverting attention from other important matters;
- Notification costs, legal fees, and potential fines – Depending on the nature of the breach, state laws may mandate notification of a suspected breach to all parties potentially impacted. Fines may be assessed, and legal costs will mount up quickly.
- Remediation – A postmortem will be necessary to ensure appropriate protocols to prevent a similar recurrence.
What steps should your business take? Just a few ways to reduce frequency and severity of attacks include:
- Requiring multi-factor authorization;
- Continual training of employees on establishing secure passwords and identifying phishing attacks;
- Purchasing cyber coverage to provide your business with immediate access to experts in cyber law, forensics, and claim management;
- Reporting all potential incidents immediately.
Our next article will address the pros and cons of paying a ransom as well as potential related sanctions. Stay tuned.